kevin o’donnell, ph.d. market compliance manager irish ... › docs › default-source ›...

Deviations– Inspection Observations & Issues to

Consider for Achieving Compliance

Kevin O’Donnell, Ph.D.Market Compliance Manager

Irish Medicines Board

IMB GMP & Market Compliance Information DayDublin, October 14th, 2010

Deviations are still a major source of deficiencies during GMP Inspections• Even in companies with an otherwise good compliance profile

• Poor management of deviations can lead to several negative outcomes:• Increased risks to patients and animals• Recurring problems with manufacturing processes & complaints• Non-compliances with Marketing Authorisations• Major and Critical Deficiencies during GMP Inspections• For-cause inspections

Why focus on deviations today?

Deviation-related issues are included in ICH Q9 & Q10 as important issues

• Deviation management features as important in 3 out of the 4 key elements of an ICH Q10 Pharmaceutical Quality System

• Process Performance & Monitoring • CAPA • Management Review

• The revised Ch 1 of the EC Guide to GMP will likely stress CAPA issues• “CAPA methodology should result in product and process improvements and

enhanced product and process understanding”

• ICH Q9 indicates how certain QRM tools (e.g. FTA) can be useful in investigating the causes of deviations

• Other tools, such as HAZOP, determine risks based on identifying deviations from the design or operational intent of the process

Why focus on deviations today... cont’d?

Five main issues seen on inspection regarding the management of deviations:

• Poor approaches to Root Cause Analysis• This can lead to the preventative actions not being fully effective

• Poor risk/impact assessment from a Batch Quality perspective • Increased risk to patients, higher chances of receiving Major & Critical Deficiencies

• Poor impact assessment from a Qualification & Validation perspective • Leading to manufacturing processes that can go out of control• This can also lead to failures in seeing important trends and in erroneous conclusions

being stated in PQR and APR work

• Poor impact assessment from a Regulatory Compliance perspective• Can lead to a lack of compliance with MAs and the cessation of batch certification

• Poor approaches to dealing with yield-related deviations • Not always treated as GMP-related deviations

What are the issues from a regulatory GMP perspective?

This area receives a lot of focus during inspections:

• Poor or insufficient Root Cause Analysis work can result in the wrong or ineffective preventative actions being identified and implemented• Sometimes a high reliance on human error as the root cause is observed, with re-

training as a common preventative measure

• Several good and simple tools available… but often not usede.g. Structured and Evidence-based Brainstorming, Fish-bone Analysis

• Sometimes deviation procedures do not actually require the root cause to be determined• Thus the proposed CAPA actions are then not linked with any documented cause(s)

• Sometimes planned deviations are approved (e.g. to rework a batch due to an OOS result) but the root cause of the issue is sometimes not adequately investigated • Thus, appropriate preventative actions cannot be identified and the issue recurs

1. Root Cause Analysis work

• Sometimes the extent of root cause analysis work to be done is determined by the Classification assigned to the deviation

• We have seen the following approach being taken:• Deviations are classified as Level I, II or III

To reflect the seriousness and potential impact of the deviation incident. • The Level assigned to a deviation determines the extent of investigation that will be

performed into the root cause of the deviationWith Level I deviations, no root cause analysis is required.

• Inspectors will look closely at how such procedures work in practice • Who assigns the Classification Level and when (i.e. at what stage in the deviation

process)?• Reason: The risk-mitigation strategy relies on the correct Level being assigned

• Sometimes deviation procedures give very rigorous classification examples - and staff lose the ability to assess each deviation on a case-by-case basis• e.g. all granulate drying time excursions are assigned a Level II

classification with no consideration to other aspects of the product

1. Root Cause Analysis work cont’d

• Often deviation procedures and forms do not make provision for there being more than one root cause associated with a deviation

• In serious deviations, experience shows that there is often more than one causative factor

• Research into how accidents occur (e.g. Normal Accident Theory) sheds a lot of light on accident pathways

…. this is probably applicable to certain deviations also

…. but how well are these areas understood or even known about in the GMP environment?


Example of Major Deficiency:

• In relation to Deviation No. 123, in which a wrong batch number had been over-printed on the outer cartons for a batch of Product X 20mcg Tablets:

• The root causes had not been adequately identified, as four different failures had occurred

The over-printing of the wrong batch number The failure to detect the error by three different groups - the over-printer, the QC team and the production team

and no preventative actions were put in place for the checking failures that had occurred.

• The deviation was attributed to human error without justification

The deviation report stated that the deviation was not the result of any GMP system failure, but this statement was not justified.

This approach was seen with many other deviations also.


This area also receives a lot of focus during inspections

• Poor or insufficient impact assessments can result in risks to patients and animals not being adequately identified before batch disposition by the QP

• This gives rise to concerns that appropriate risk mitigating actions were not taken• This becomes a serious problem during inspection when the batch was released

• Sometimes, deviations are not classified in accordance with the risk-based classification system documented for deviations, and this means that the risk(s) associated with the deviation are often not assessed

• Sometimes those assigning the classification are not the appropriate staff

• For significant deviations, sometimes the necessary evidence supporting batch quality is not obtained to support release of the batch

Additional testing was omitted or was not sufficientA Stability Study were not performed on the batch in question A Concurrent Validation Study not performed

Some deviation investigations require these

2. Deviation Impact/Risk Assessments –wrt Batch Quality


In relation to the deviation with Batch X of Product Y 120mg Tablets, which involved a problem with powder flowability during blending:

• The deviation was not classified in accordance with the classification system used by the company, and this meant that the risk associated with the deviation had not been assessed.

• The statement in the Deviation report that there was no validation impact associated with this deviation was not justified• The batch had to be reprocessed using a significantly different manufacturing process

over that normally used for the product, and some level of (concurrent) validation was likely required;

• In relation to the flowability issue, no potential causes were investigated or identified.

2. Deviations & Batch Quality, cont’d


• In relation to Deviation No. ABC, relating to the under-washing (by 15%) of 8 API batches in the centrifuge due to a flow-meter error:

• There was no justification stated as to why no validation work was required to demonstrate homogeneity of the batches wrt impurity levels

This was important given that the washing volume actually used was not supported by any process validation data; it was only supported by gram scale laboratory data.



• In relation to the deviation with Batch 123 of Product X 10mg tablets, which involved the use of a different primary packaging component (PVC/PVDC) over what was approved:

• There was no assessment made of the potential impact of the deviation on batch quality;

• The batch was not placed on stability and thus, the stability of this formulation in PVC/PVDC packaging had not been assessed;

• The SOP on Stability Studies, Document No. 123/4, required changes in primary packaging components to be evaluated via a stability study, but this requirement was not complied with for this batch.

• The statement in the Deviation report that there was no regulatory impact for this deviation was not justified

The deviation did require a notification to be sent to the relevant Competent Authority which had authorised the product



• In relation to the deviation with Batch 123 of Product 5mg Capsules, which involved the use of a Drum Blender instead of the required IBC blender for the powder blending process:

• No assessment was made of the potential impact of the deviation on batch quality;

• There was no assessment made of the potential impact of the deviation on the cleaning procedure for the drum

… and the company had not assessed whether the current cleaning procedure could effectively clean the drum following processing of this new product.

• The statement in the Deviation report that there was no validation impact associated with this deviation was not justified

… as there was the possibility that a new cleaning validation study was required to determine whether the cleaning procedure was effective with this new product.


Some deviations cast doubt on the Qualification status of equipment or on the Validation status of the manufacturing process, but these areas are sometimes not adequately investigated

For example, at an API Manufacturer:

Several deviation investigations had been initiated following the receipt of complaints from a customer in relation to lumps being found in batches of API X. • In relation to Deviation No. Y, which related to the first such complaint,

No consideration was documented in the deviation report for the need to check the functionality of the temperature or pressure alarms on the mill, and these elements of the mill were considered important for this issue

• In relation to Deviation No. Z, which related to the second complaint of lumps being found in another batch of API X,

There was no assessment documented in the deviation report of the impact of the deviation on the qualification status of the mill, or the validation status of the milling process.

3. Impact Assessment – Qualification & Validation Status

When companies fail to determine that a deviation may indicate a problem with the qualification or validation status of equipment or processes, PQR / APR reports may contain erroneous statements

For example:

• The 2008-2009 PQR for Product A contained no review or discussion of the six deviations that had occurred during 2008, or of their resultant corrective and preventative actions.

• There was inadequate justification provided in several Annual Product Reviews for the statements that analytical methods X & Y were capable and in control• This was important given the system suitability problems that had been observed with

those methods during the review period

• No review had been performed during the last three years of the validation status of the manufacturing process for Product B, and thus the impact of any changes and deviations had not been formally assessed.

• Eleven batches had been manufactured during that time.

3. Impact Assessment – Qualification & Validation Status

Sometimes, deviation procedures do not adequately deal with the need to assess deviations from a regulatory compliance perspective before batch disposition

Also, while deviation procedures may require assessment from a regulatory compliance perspective, the actual practices on site sometimes do not comply with this

• This can lead to non-compliant batches being released• Risks to patients and animals may be increased• MA non-compliances may continue to arise, and before long, the extent of non-

compliance can become relatively high• QPs may be viewed as being negligent:

Releasing batches that are not compliant with the relevant MA

4. Impact Assessment – Regulatory Compliance

Examples from Major & Other Deficiencies:

• The deviations procedure did not specify any role for the regulatory affairs function in assessing deviation reports. • This was despite the fact that the role profile for the site Regulatory Affairs Specialist

required that person to assess and approve all deviation reports.

• Neither the Deviations SOP nor its associated Form clearly addressed which documents needed to be checked when the potential regulatory impact of a deviation was being determined. • The company stated that there were three types of documents that needed to be

consulted to establish this –documents showing what was registereddocuments showing what was filed but not yet registeredpre-filing documentation

• In Deviation No. 123, relating to an OOS batch for Residue on Ignition, the deviation report stated that the deviation had no regulatory impact, but this was incorrect, as the Residue on Ignition test was a registered test.


Examples from Major & Other Deficiencies:

• The Deviations SOP did not address whether deviations would be taken into account during batch certification activities.

• In relation to Deviation No. X, in which the outer carton label for 11 batches of Product X 5mg tablets were non-compliant due to a cut and paste error during artwork generation, one of the non-compliant batches had been released to the Irish market by the QP who had knowledge of the deviation at the time

….. and neither the provisions of the EMA Reflection paper on compliance with the MA nor the IMB Batch Specific Request route had been used by the QP to justify placing this batch onto the Irish market.

• It is important for QPs to know the options available to them for managing deviations from a regulatory perspective

e.g. QP Reflection Paper, BSRs, Other Variation types


Sometimes, deviations in yield are not treated or investigated as GMP-related deviations

For example:

• In relation to the deviation with Batch 123 of Product X 100mg Capsules, which involved a significantly low yield at the end of encapsulation (83%, Limits = 96% - 101%) :

• The statement in the Deviation report that there was no regulatory impact for this deviation was incorrect – the batch was out of compliance with its Marketing Authorisation with respect to batch yield;

• There was no assessment made of whether the batch was of unusual quality (in terms of particle size

This was important given that over 6Kg of the blend had remained in the vacuum equipment on the encapsulator and the potential effect of the deviation on the bioavailability of the batch and on content uniformity had not been considered

5. Dealing with Yield-related deviations

For example:

• Some companies do have thorough approaches to Root Cause Analysis and Impact/Risk Assessment work• e.g. Six-sigma type approaches utilising formalised tools• e.g. Fishbone Analysis is used to determine the most likely root causes of a deviation

and the results are then fed into an FMEA to assess the related risks

• Some companies ensure that self-inspection programmes look closely at the management of deviations

• Some companies have robust systems in place (e.g. effective communication systems with Reg. Affairs staff) to accurately determine the Regulatory Compliance impact of deviations

• Some companies ensure that the Deviation Management systems at their Suppliers and Contract Manufacturers are formally assessed during initial qualifications and audits• Surprising, some other companies overlook this!

But good practices are seen on inspection too!

1. Develop more rigorous approaches to Quality Risk Management when assessing the impact and risks associated with deviations

• Move towards techniques that rely less on subjective opinion• Considering developing GMP-tailored QRM tools for GMP applications!

See IMB Presentation at the November 2007 PharmaChemical Ireland Conference in Cork for examples of practical strategies that can be useful here

• Certify certain individuals for such Quality Risk Management work?

2. To achieve better impact assessments, consider moving away from just using checklistapproaches in Deviation forms and don’t make deviation procedures too rigorous

• More open procedures and forms can encourage staff to “think” about the various impacts that the deviation may have

This may lead to more high level and lateral thinkingSome research in this area would be useful

Seven Recommendations… for achieving better deviation management

3. Put more robust systems in place to ensure that the manufacturing documentation on site accurately reflects the MA for the product (both at your company and at suppliers and contract manufacturers)

• Experience has shown that, where the controls for keeping site documentation accurate and up-to-date wrt MAs are poor, deviations can easily occur over and over again…

… and by the time the issue is discovered, the extent of the non-compliance can have become quite extensive

The systems in place in companies (especially global companies) wrt MA documentation can be very complex

Formal process mapping studies can indicate which parts of the system are most complex and have high levels of human intervention / handoverThis information can be used to design more effective self-inspection programmes wrt MA compliance

Recommendations, cont’d

4. Make sure that QPs, QA & Regulatory Affairs staff know the options provided by:

• IMB’s Batch Specific Request procedure

• The EMA’s Procedure for dealing with MA-non compliances (Reflection Paper)

Limited in scope but can be useful in some casesEnsure that, if this procedure is used, it is fully complied with

Minor quality deviation with no impact on safety or efficacyOnce off & unplanned - non-recurring in natureThe active substance and finished product specifications as described in the marketing authorisation or clinical trial application are complied withStability requirements are formally considered during the risk assessmentIf the product is a biological, the risk assessment should consider that even minor changes can have an unexpected impact on safety or efficacyThe Quality Risk Management process used to assess the risk is integrated into the QMS


5. Start to formally capture near misses within your site QMS• Seldom done at present (except for Health & Safety issues) but has proven very

useful in other industries• This can help companies see deviation signals before actual deviations occur

6. Be open to what may be offered by Good Behavioural Practice studies• Early days yet…. but this area has the potential to be useful in

reducing the incidence and seriousness of deviations


7. Put systems in place that will help you move away from assigning human error as the cause and retraining as a preventative measure, unless this is scientifically justified

• Move towards using more formalised Root Cause Analysis techniques• Put in place more rigorous and scientific approaches to Brainstorming• Develop a high level of personnel competency in these areas within your site

Idea – Certify certain individuals for such work?


Simple (but structured) root cause analysis tools can be used to check the validity of assigning human error as the cause of an incident or complaint• Five Whys

Useful & easy to use, forces a more in-depth analysis of the causes of an incident• Fishbone (Ishikawa) Analysis

Useful as it forces us to look at other areas, apart from people• Fault Tree Analysis – highly rigorous and structured, but requires more expertise and

can be relatively complex to use

• Other Quality Risk Management tools may be used also as these usually have an element of root cause analysis within them• Probabilistic Risk Assessment – good but quite complex and time consuming• FMEA – not so useful here, as very light on root cause analysis steps• Event Tree Analysis –used by NASA to construct accident pathways from an

initiating event Useful as the value of current controls is formally assessedBut relatively complex to use

Beyond human error...

Simple questions can be inserted into deviation procedures to ensure that staff consider key issues when working to identify the likely root causes of issues

• If designed correctly, this should force the person using the procedure to take a more in-depth look at the current controls that are in place before assigning human error as the cause of the incident

• IMB Presentation at a December 2nd 2009 Human Error Conference in Cork provides an example of such an approach (Ref. Pharmaskillnet and PharmaChemical Ireland)

• The questions were designed to help explore what factors, other than human error, may have caused or contributed to the incident in question

The answers to those questions may confirm that human error was the cause of the incident, or that it was not a causal factor

Fishbone analysis is also very useful in this regard

Beyond human error, cont’d

One might also use specific human error-related methodologies during deviation and complaint investigations

• Several tools are available, such as:• Human factors engineering • Human reliability analysis

These seek to model the role of human error prior to, during, and following accidents

• Note: HRA has been used when doing probabilistic risk assessments at nuclear power plants to analyse how human error may contribute to accidents

Two types of potential human errors are normally considered here:Pre-accident errors, such as the mis-calibration of an item of equipmentPost-accident errors, such as the failure to diagnose and respond appropriately to an accident

Beyond human error, cont’d

The absolute or ‘true’ root cause is often not identifiable

Why?• The cause of any incident or failure will likely have its own causative event(s)

• These will normally be at what is called an indenture level lower down in the process or item under study

• Root cause analysis could theoretically proceed all the way down to the molecular level, and this would of course be a waste of time and resources, even if it were possible.

Proposed Solution: • It is more beneficial to look for functional root causes, and to go “down” to an indenture

level in the system that gives you these• These are root causes that can be addressed with functional and realistic controls• See the case study presented in the Journal of Validation Technology

February 2007 issue for a practical example of this

How far down should one go when looking for the ‘true’ root cause of deviations?

Questions & Discussion

Thank you for your attention!

kevin o’donnell, ph.d. market compliance manager irish ... › docs › default-source ›...

Documents